From 3317cfd46604bd1d72a46a9725e727edc3933176 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 13:45:33 +0000
Subject: [PATCH 1/2] Initial plan


From f63caa706116e7356bce5360836fbb6be35ce4c3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 13:47:37 +0000
Subject: [PATCH 2/2] refactor: internalize secureWipeFile export

---
 src/ssl-key-storage.test.ts | 3 ++-
 src/ssl-key-storage.ts      | 7 +++++--
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/ssl-key-storage.test.ts b/src/ssl-key-storage.test.ts
index 017475155..00075333a 100644
--- a/src/ssl-key-storage.test.ts
+++ b/src/ssl-key-storage.test.ts
@@ -39,11 +39,12 @@ import * as path from 'path';
 import { mockExecaFn } from './test-helpers/mock-execa.test-utils';
 import {
   mountSslTmpfs,
-  secureWipeFile,
   cleanupSslKeyMaterial,
+  testHelpers,
 } from './ssl-key-storage';
 
 const FAKE_FD = 42;
+const { secureWipeFile } = testHelpers;
 
 describe('ssl-key-storage', () => {
   beforeEach(() => {
diff --git a/src/ssl-key-storage.ts b/src/ssl-key-storage.ts
index 10b5d27ce..097b2c905 100644
--- a/src/ssl-key-storage.ts
+++ b/src/ssl-key-storage.ts
@@ -77,9 +77,8 @@ export async function unmountSslTmpfs(sslDir: string): Promise<void> {
  * cannot be guaranteed on all filesystems (for example, journaling/COW).
  *
  * @param filePath - Path to the file to securely wipe
- * @internal Exported for testing
  */
-export function secureWipeFile(filePath: string): void {
+function secureWipeFile(filePath: string): void {
   let fd: number | undefined;
 
   try {
@@ -167,3 +166,7 @@ export function cleanupSslKeyMaterial(workDir: string): void {
 
   logger.debug('SSL key material securely wiped');
 }
+
+/** @internal Exposed for unit tests. */
+// ts-prune-ignore-next
+export const testHelpers = { secureWipeFile };